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Mission 

Our  mission  is  to  provide  independent,  relevant,  and  timely  oversight 
of  the  Department  of  Defense  that  supports  the  warfighter;  promotes 
accountability,  integrity,  and  efficiency;  advises  the  Secretary  of 
Defense  and  Congress;  and  informs  the  public. 


Vision 

Our  vision  is  to  be  a  model  oversight  organization  in  the  Federal 
Government  by  leading  change,  speaking  truth,  and  promoting 
excellence — a  diverse  organization,  working  together  as  one 
professional  team,  recognized  as  leaders  in  our  field. 


Fraud,  Waste  &  Abuse 

HOTLINE 

Department  of  Defense 

dodig.mil/hotline  1800.424. 9098 


For  more  information  about  whistleblower  protection,  please  see  the  inside  back  cover. 


Results  in  Brief 

DoD  Cardholders  Used  Their  Government  Travel 
Cards  for  Personal  Use  at  Casinos  and  Adult 
Entertainment  Establishments 


May  19,  2015 


Finding  (cant'd) 


Objective 

Our  objective  was  to  determine  whether 
DoD  Government  travel  charge  card  holders 
used  their  card  for  personal  use  at  casinos 
or  adult  entertainment  establishments. 

Public  Law  112-194,  “Government  Charge 
Card  Abuse  Prevention  Act  of  2012," 
requires  the  Inspector  General  of  each 
executive  agency  with  more  than  $10  million 
in  travel  card  spending  to  periodically 
audit  or  review  travel  card  programs.  We 
focused  on  individually  billed  travel  cards. 
Cardholders  are  personally  and  financially 
liable  for  payment  of  all  undisputed  charges, 
including  personal  use,  indicated  on  the 
billing  statement,  not  the  government. 

Finding 

DoD  cardholders  improperly  used  their 
Government  travel  charge  card  (GTCC) 
for  personal  use  at  casinos  and  adult 
entertainment  establishments.  From 
July  1,  2013,  through  June  30,  2014, 

DoD  cardholders  had  4,437  transactions 
totaling  $952,258,  where  they  likely  used 
their  travel  cards  at  casinos  for  personal 
use  and  had  900  additional  transactions 
for  $96,576  at  adult  entertainment 
establishments.  Specifically,  we  reviewed 
seven  nonstatistically  selected  cardholders 
who  had  76  transactions  valued 
at  $19,643  to  confirm  that  our  analysis 
identified  personal  use  at  casinos  and 
adult  entertainment  establishments  from 
July  1,  2013,  to  June  30,  2014.  DoD  did  not 
detect  these  transactions  because: 


•  DoD  policy  did  not  specifically  identify  high-risk 
merchants  or  categories  for  personal  use  such  as  in 
casinos  or  adult  entertainment  establishments;  and 

•  Citibank  was  not  required  to  notify  Agency  Program 
Coordinators  or  management  officials  of  potential 
fraudulent  activity  or  suspension  of  accounts. 

As  a  result.  Component  Program  Managers  and  Agency 
Program  Coordinators  did  not  have  sufficient  details  on 
transactions  that  occurred  at  casinos  or  adult  entertainment 
establishments  to  determine  if  there  was  misuse.  Unless 
DTMO  and  the  Component  Program  Managers  improve 
oversight  actions,  improve  internal  controls  of  the 
GTCC  program,  and  provide  written  prohibition  of  the  use  of 
the  GTCC  at  high-risk  merchants,  DoD  personnel  may  continue 
to  use  their  GTCCs  for  personal  use  at  casinos  and  adult 
entertainment  establishments.  Finally,  without  these  controls 
in  place  the  Department  will  not  be  able  to  identify  and  hold 
personnel  accountable  for  misuse  of  the  GTCC. 

Recommendations 

We  made  several  recommendations  to  address  these  problems. 
See  the  recommendations  sections  of  the  finding  in  the  report. 

Management  Comments 
and  Our  Response 

Comments  from  the  Director,  Defense  Travel  Management 
Office  addressed  recommendations  l.e;  partially  addressed 
l.a,  l.b,  l.c,  and  l.d.2;  and  did  not  address  the  specifics 
of  l.d.l.  Comments  from  the  Service  Component  Program 
Managers  partially  addressed  recommendations  2-5.  We 
request  comments  in  response  to  the  recommendations  by 
June  30,  2015.  Please  see  the  Recommendations  Table  on  the 
back  of  this  page. 


•  the  Defense  Travel  Management  Office 
(DTMO)  compliance  program  did  not 
assist  Agency  Program  Coordinators 
to  identify  personal  use  at  casino  and 
adult  entertainment  establishments; 
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Recommendations  Table 


Management 

Recommendations 
Requiring  Comment 

No  Additional 
Comments  Required 

Director,  Defense  Travel  Management  Office 

l.a,  l.b,  l.c,  and  l.d 

l.e 

Army  Component  Program  Manager 

2 

Navy  Component  Program  Manager 

3 

Air  Force  Component  Program  Manager 

4 

U.S.  Marine  Corps  Component  Program  Manager 

5 

Please  provide  Management  Comments  by  June  30,  2015 
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INSPECTOR  GENERAL 

DEPARTMENT  OF  DEFENSE 

4800  MARK  CENTER  DRIVE 
ALEXANDRIA,  VIRGINIA 22350-1 500 


May  19,  2015 


MEMORANDUM  FOR  DISTRIBUTION 

SUBJECT:  DoD  Cardholders  Used  Their  Government  Travel  Cards  for  Personal  Use  at  Casinos 
and  Adult  Entertainment  Establishments  [Report  No.  DODIG-2015-125] 

We  are  providing  this  report  for  your  review  and  comment.  We  considered  management 
comments  on  a  draft  of  this  report  when  preparing  the  final  report.  DoD  cardholders 
improperly  used  their  Government  Travel  Charge  Card  for  personal  use  at  casinos  and  adult 
entertainment  establishments.  From  July  1,  2013,  through  June  30,  2014,  DoD  cardholders 
had  4,437  transactions  totaling  $952,258,  where  they  likely  used  their  travel  cards  at  casinos 
for  personal  use  and  had  900  additional  transactions  for  $96,576  at  adult  entertainment 
establishments.  We  conducted  this  audit  in  accordance  with  generally  accepted  government 
auditing  standards. 

DoD  Instruction  7650.03  requires  that  recommendations  be  resolved  promptly.  Comments 
from  the  Director,  Defense  Travel  Management  Office  addressed  Recommendation  l.e  and 
partially  addressed  Recommendations  l.a,  l.b,  l.c,  and  l.d.  Therefore,  we  request  comments 
on  Recommendations  l.a,  l.b,  l.c,  and  l.d.  Comments  from  the  Deputy  Assistant  Secretary 
of  the  Army,  Financial  Operations,  responding  for  the  Army  Component  Program  Manager, 
partially  addressed  Recommendation  2.  Therefore,  we  request  additional  comments  on 
Recommendation  2.  Although  the  Navy,  Air  Force,  and  Marine  Corps  Component  Program 
Managers  did  not  provide  a  memorandum,  each  Service  provided  comments  in  a  spreadsheet 
that  partially  addressed  Recommendations  3,  4,  and  5.  Therefore,  we  request  additional 
comments  on  Recommendations  3,  4,  and  5.  We  request  all  comments  be  received 
by  June  30,  2015. 

Please  send  a  PDF  file  containing  your  comments  to  aud-colu@dodig.mil.  Copies  of  your 
comments  must  have  the  actual  signature  of  the  authorizing  official  for  your  organization. 

We  cannot  accept  the  /Signed/  symbol  in  place  of  the  actual  signature.  If  you  arrange  to  send 
classified  comments  electronically,  you  must  send  them  over  the  SECRET  Internet  Protocol 
Router  Network  [SIPRNETJ. 

We  appreciate  the  courtesies  extended  to  the  staff.  Please  direct  questions  to  me  at 
[703]  604-9187  [DSN  664-9187]. 


Michael  J.  Roark 
Assistant  Inspector  General 
Contract  Management  and  Payments 
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Introduction 


Objective 

We  determined  whether  DoD  Government  travel  charge  card  holders  used  their 
cards  for  personal  use  at  casinos  or  adult  entertainment  establishments.  We 
focused  on  individually  billed  travel  cards.  Cardholders  are  personally  and 
financially  liable  for  payment  of  all  undisputed  charges,  including  personal  use, 
indicated  on  the  billing  statement,  not  the  government.  See  Appendix  for  the  scope 
and  methodology  related  to  our  audit  objective. 

Audit  Requirement  in  Public  Law  112-194  "Government  Charge 
Card  Abuse  Prevention  Act  of  2012" 

Public  Law  112-194^  requires  the  Inspector  General  of  each  executive  agency  with 
more  than  $10  million  in  travel  card  spending  to  periodically  audit  or  review  travel 
card  programs  to  analyze  risks  of  illegal,  improper,  or  erroneous  purchases  and 
payments.  The  findings  of  such  audits  or  reviews,  along  with  recommendations  to 
prevent  improper  use  of  travel  cards,  are  reported  to  the  Director  of  the  Office  of 
Management  and  Budget  and  to  Congress. 

Background 

General  Services  Administration 

The  General  Services  Administration  (GSA]  is  responsible  for  issuing 
Government-wide  travel  card  policies  and  procedures  for  implementing  the 
Travel  and  Transportation  Reform  Act  of  1998.  GSA  awards  and  administers  a 
master  contract  for  the  travel  card  program.  On  behalf  of  DoD,  GSA  placed  a  task 
order  with  Citibank  on  the  master  contract  effective  January  2008.  In  2011,  DoD 
exercised  the  first  option  period  and  extended  the  contract  with  Citibank  from 
November  29,  2011,  through  November  29,  2015. 

DoD  Travel  Card  Program 

The  DoD  Government  Travel  Charge  Card  (GTCC)  Program  provides  travelers 
with  an  effective,  convenient,  and  commercially  available  way  to  pay  for  expenses 
related  to  official  travel.  The  GTCC  is  the  primary  payment  method  for  official 
travel  expenses  incurred  by  DoD  personnel,  is  mandatory  for  all  DoD  personnel 
who  have  been  issued  a  travel  card,  and  is  for  official  travel-related  use  only. 


^  Public  Law  112-194,  "Government  Charge  Card  Abuse  Prevention  Act  of  2012,"  October  5,  2012. 
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Official  Government  travel  is  defined  as  travel  under  official  orders  while 
performing  duties  pertaining  to  official  Government  assignments  such  as 
temporary  duty  and  permanent  change  of  station.  In  most  instances,  duties 
pertaining  to  official  Government  assignments  would  occur  in  the  official 
travel  location. 

From  July  1,  2013,  through  June  30,  2014,  DoD  cardholders  used  their  individually 
billed  cards  to  make  approximately  20  million  transactions  totaling  $3.4  billion.  As 
of  June  30,  2014,  DoD  had  1,682,423  individually  billed^  travel  cards. 

Defense  Travel  Management  Office 

The  Defense  Travel  Management  Office  [DTMO)  is  the  travel  card  program  manager 
for  all  DoD  Components.  It  provides  guidance,  policy,  and  coordinates  training 
related  to  the  DoD  travel  card  program.  DTMO  is  also  the  liaison  to  GSA,  Citibank, 
and  the  Component  Program  Managers  [CPMs)  on  all  travel  card-related  issues. 

DoD  Comptrollers 

The  Military  Department  Assistant  Secretaries  (Financial  Management  and 
Comptroller]  and  Defense  Agency  Comptrollers,  or  equivalents,  are  required  to 
ensure  that  program  management  responsibilities  are  accomplished  within  their 
respective  Component. 

DoD  Component  Heads/Defense  Agency  Directors 

The  heads  of  the  DoD  Components  are  required  to  develop  strategies  to  implement 
the  Travel  and  Transportation  Reform  Act  of  1998  in  their  respective  Components. 
The  Component  heads  will  also  ensure  all  personnel,  including  Agency  Program 
Coordinators  (APCs],  Centrally  Billed  Account  (CBA)  Managers,  and  cardholders,  are 
properly  trained  on  travel  card  use  and  policy. 


^  The  DoD  Travel  Card  Program  has  both  individually  billed  travel  cards  and  centrally  billed  accounts  (CBAs).  Individually 
billed  travel  cards  are  issued  to  DoD  personnel.  The  cardholder  is  personally  and  financially  liable  for  payment  of 
all  undisputed  charges,  including  personal  use,  indicated  on  the  billing  statement,  not  the  government.  We  discuss 
individually  billed  travel  cards  throughout  the  report.  CBAs  are  provided  to  DoD  activities  to  make  travel  arrangements 
for  official  federal  government  travel.  We  discuss  CBAs  in  the  Appendix. 
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Component  Program  Managers 

CPMs  are  DoD  personnel  [military  or  civilian)  designated  in  writing  by  the 
Component  head  or  designee.  They  are  required,  but  not  limited  to: 

•  establish  and  manage  their  respective  travel  card  program; 

•  establish  and  maintain  the  Component’s  organizational 
structure  [hierarchy);  and 

•  notify  the  DTMO  and  the  travel  card  vendor  of  any  changes  in 
organizational  structure  that  affect  the  travel  card  program. 

Agency  Program  Coordinators 

APCs  are  designated  in  writing  by  a  commander  or  director  and  are  responsible  for 
program  execution  and  management  of  the  day-to-day  operations  of  the  DoD  travel 
card  program.  APCs  are  required  to: 

•  maintain  or  have  access  to  all  pertinent  records  such  as: 

o  statements  of  understanding; 
o  certificates  of  training;  and 

o  delinquency  notices  for  cardholders  assigned  to  their  hierarchy; 

•  generate  and  review  required  reports; 

•  use  the  data  mining  tools  provided  by  the  travel  card  vendor; 

•  gather  and  analyze  travel  card  data;  and 

•  identify  incidents  of  suspected  misuse. 

Travel  Cardholders 

DoD  personnel  who  have  been  issued  a  travel  card  for  use  while  performing  official 
Government  travel  must: 

•  adhere  to  the  procedures  in  the  DoD  Financial  Management 
Regulation  [FMR),  Component  guidance,  and  the  travel  card  vendor’s 
cardholder  agreement  and  terms  and  conditions  of  use; 

•  use  the  travel  card  for  all  expenses  related  to  official  travel; 

•  submit  travel  vouchers  within  5  business  days  of  completion  of  travel; 

•  use  split  disbursement  to  pay  all  expenses  charged  to  the  card  directly  to 
the  travel  card  vendor;  and 

•  pay  all  undisputed  charges  in  full  by  the  due  date  on  their  billing  statement, 
regardless  of  the  status  of  their  travel  reimbursement. 


DODIG-2015-125  |  3 


Introduction 


Review  of  Internal  Controls 

DoD  Instruction  5010.40,  "Managers’  Internal  Control  Program  Procedures," 

May  30,  2013,  requires  DoD  organizations  to  implement  a  comprehensive  system  of 
internal  controls  that  provides  reasonable  assurance  that  programs  are  operating 
as  intended  and  to  evaluate  the  effectiveness  of  the  controls.  We  identified  internal 
control  weaknesses  associated  with  the  DTMO  Compliance  Program’s  lack  of  tools, 
techniques,  and  technologies  to  assist  APCs  in  identifying  personal  use,  merchants 
or  categories  that  were  considered  high-risk  for  personal  use,  and  requirements  of 
Citibank  to  notify  APCs  of  potential  fraudulent  activity  or  suspension  of  accounts. 
We  will  provide  a  copy  of  the  report  to  the  senior  officials  in  charge  of  internal 
controls  in  the  Military  Departments,  Defense  agencies.  Defense  Travel  Management 
Office,  and  DoD  Field  Activities. 
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Finding 

DoD  Government  Travel  Charge  Cards  Were  Used  at 
Casinos  and  Adult  Entertainment  Establishments 

DoD  cardholders  improperly  used  their  GTCCs  for  personal  use^  at  casinos  and 
adult  entertainment  establishments.  From  July  1,  2013,  through  June  30,  2014, 

DoD  cardholders  had  4,437"*  transactions,  totaling  $952,258,  where  they  likely 
used  their  travel  cards  for  personal  use  at  casinos  and  had  900  additional 
transactions  for  $96,576  at  adult  entertainment  establishments.  We  reviewed 
seven  nonstatistically  selected  cardholders  who  had  76  transactions  valued  at 
$19,643  to  confirm  that  our  analysis  identified  personal  use  at  casinos  and  adult 
entertainment  establishments  from  July  1,  2013,  through  June  30,  2014.  DoD  did 
not  detect  these  transactions  because: 

•  the  DTMO  compliance  program  did  not  help  APCs  identify  personal  use 
at  casino  and  adult  entertainment  establishments; 

•  DoD  policy  did  not  specifically  identify  high-risk  merchants  or 
categories  for  personal  use  such  as  casinos  or  adult  entertainment 
establishments;  and 

•  Citibank  was  not  required  to  notify  APCs  or  management  officials  of 
potential  fraudulent  activity  or  suspension  of  accounts. 

As  a  result,  CPMs  and  APCs  did  not  have  sufficient  details  on  transactions  that 
occurred  at  casinos  or  adult  entertainment  establishments  to  determine  whether 
there  was  misuse.  Unless  DTMO,  CPMs  and  APCs  improve  oversight  actions, 
improve  internal  controls  of  the  CTCC  program,  and  provide  written  prohibition 
of  the  use  of  the  CTCC  at  high-risk  merchants,  DoD  personnel  may  continue  to 
improperly  use  their  CTCCs  for  personal  use  at  casinos  and  adult  entertainment 
establishments.  Finally,  without  these  controls  in  place  the  Department  will  not  be 
able  to  identify  and  hold  personnel  accountable  for  misuse  of  the  CTCC. 


^  Personal  use  is  defined  as  use  of  the  GTCC  for  expenses  that  do  not  relate  to  authorized  expenses  relating  to  official 
Government  travel.  This  includes  any  use  of  Government  charge  cards  at  establishments  or  for  purposes  that  are 
inconsistent  with  the  official  business  of  DoD  or  with  applicable  regulations.  Personal  use  is  misuse  and  may  be 
considered  abuse. 

^  This  includes  transactions  for  organizations  that  do  not  use  Defense  Travel  System  such  as  U.S.  Army  Corps  of  Engineers 
and  U.S.  Air  Force  Reserve. 
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DoD  Cardholders^  Personal  Use  of  the  Government 
Travel  Charge  Card 

DoD  cardholders  did  not  comply  with  DoD  GTCC  policy  and  improperly  used  their 
GTCC  for  personal  use.  DoD  Financial  Management  Regulation  (FMR]^  requires 
DoD  personnel  to  use  the  GTCC  for  all  costs  related  to  official  government  travel 
and  not  for  personal  use. 

From  July  1,  2013,  through  June  30,  2014,  DoD  cardholders  used  their  cards 
to  make  over  20  million  transactions  totaling  $3.4  billion.  We  queried  the 
Visa  IntelliLink  Compliance  Management  system®  to  obtain  transactional  data 
from  July  1,  2013,  through  June  30,  2014,  that  occurred  at  casinos  and  adult 
entertainment  establishments. 

The  universe  of  U.S.  casinos  included  24,119  GTCC  transactions  by 
13,575  cardholders  totaling  $3,261,727.  We  analyzed  the  data  to  identify 
transactions  at  casinos  that  had  indicators  of  personal  use  and  to  eliminate 
transactions  that  were  for  official  use.  As  a  result  of  this  analysis,  the 
universe  of  inappropriate  transactions  at  casinos  that  were  likely  for 
personal  use  was  4,437  transactions  by  2,636  cardholders  totaling  $952,258. 

The  universe  of  U.S.  adult  entertainment  establishments  was  900  GTCC 
transactions  by  646  cardholders  totaling  $96,576.  Table  1  shows  the  casino 
and  adult  entertainment  establishment  transactions  for  each  Service  and  the 
Defense  agencies. 


Table  1.  Casino  and  Adult  Entertainment  Establishment  Transactions  by  Service  and  the 
Defense  Agencies  Where  Personal  Use  Was  Likely 


Component 

Casino 

Transactions 

Casino 
Amount  ($) 

Adult 

Transactions 

Adult 

Amount  ($) 

Army 

1,660 

$348,538 

365 

$34,837 

Navy 

583 

109,017 

107 

16,067 

Air  Force 

1,803 

404,675 

347 

37,491 

Marine  Corps 

290 

65,127 

67 

6,636 

Defense 

Agencies 

101 

24,901 

14 

1,545 

Total 

4,437 

$952,258 

900 

$96,576 

NOTE:  Cardholders  are  personally  and  financially  liable  for  payment  of  all  undisputed  charges, 
including  personal  use,  indicated  on  the  billing  statement,  not  the  government. 


®  DoD  Financial  Management  Regulation  7000.14-R,  volume  9,  chapter  3,  "Department  of  Defense  Government  Travel 
Charge  Card  (GTCC)." 

^  Visa  IntelliLink  Compliance  Management  is  a  web-based  application  that  provides  analytics  and  investigative  reporting, 
misuse  detection,  program  compliance,  and  regulatory  compliance. 
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After  we  identified  the  universe  of  transactions  where  DoD  personnel  likely  used 
their  travel  cards  for  personal  use  at  casinos  or  adult  entertainment 
establishments,  we  reviewed  seven  cardholders  who  had  76  transactions,  valued  at 
$19,643,  for  personal  use.  We  selected  the  seven  cardholders  using  their  activity 
from  July  1,  2013,  through  June  30,  2014;  however,  after  identification,  we  reviewed 
additional  transactions  beyond  those  dates  to  determine  whether  there  was  prior 
or  subsequent  abuse.  See  Appendix  for  the  scope  and  methodology  related  to  our 
audit  objective. 


Improvements  Needed  for  Detection  of  Personal  Use 


The  CPMs  and  APCs  did  not  detect  that  DoD  personnel  improperly 


used  their  GTCC  for  personal  use  at  casinos  and  adult 
entertainment  establishments.  Public  Law  112-194  requires 
each  executive  agency  to  use  effective  systems,  techniques, 
and  technologies  to  prevent  or  identify  improper  purchases. 
In  April  2013  the  DTMO  Compliance  Program  began 
using  an  automated  tool,  the  Travel  Policy  Compliance  Tool 
(compliance  tool),  to  review  all  DoD  Defense  Travel  System 
(DTS)  travel  vouchers  for  compliance  with  DoD  travel  policy. 


CPMs 
and  APCs 
did  not  detect 
that  DoD  personnel 
improperly  used 
their  CTCC  for 
personal  use 


However,  the  compliance  tool  did  not  review  CTCC  transactions  for 


personal  use. 


To  comply  with  Public  Law  112-194  requirements  to  prevent  or  identify  improper 
purchases,  DTMO  personnel  need  to  modify  the  compliance  tool  or  use  other 
systems,  techniques,  and  technologies  to  identify  personal  use  at  casinos  and  adult 
entertainment  establishments  and  notify  the  CPMs  and  APCs  of  potential  abuses 
(repetitive  misuse)  of  the  CTCC.  The  Director,  DTMO,  should  coordinate  with  the 
Military  Services,  Defense  agencies,  and  Citibank  representatives  to  determine 
what  tools,  techniques,  or  technologies  are  most  appropriate  to  prevent  or  identify 
personal  use  of  the  GTCC  at  casinos  and  adult  entertainment  establishments. 

During  our  detailed  review  of  the  seven  cardholders  there  were  several  common 
attributes  of  the  GTCC  transactions  that  we  confirmed  as  personal  use  of  the 
GTCC.  These  attributes  were  used  to  identify  the  universe  of  transactions  as 
high  risk  for  misuse  including  4,437  transactions  totaling  $952,258  at  casinos  and 
900  transactions  for  $96,576  at  adult  entertainment  establishments.  Specifically, 
the  attributes  include  GTCC: 


•  transactions  with  no  associated  travel  status  in  DTS; 

•  automated  teller  machine  (ATM)  withdrawals  that  exceeded  the  overall 
Meal  and  Incidental  Expense  (M&IE)  amounts  while  in  a  travel  status; 
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•  transactions  at  known  casinos  and  adult  entertainment  establishments; 

•  declined  authorization  activity  that  could  indicate  personal  use;  and 

•  activity  outside  the  required  official  Government  travel  locations. 

Use  of  the  Government  Travel  Charge  Card  While  Not  in  Travel 
Status  Could  Indicate  Personal  Use 

DoD  personnel  improperly  used  their  GTCC  at  casinos  or  adult  entertainment 
establishments  while  not  in  official  travel  status;  however,  the  Director,  DTMO 
did  not  have  the  tools  in  place  to  identify  the  improper  use.  Three  of  the  seven 
cardholders  reviewed  used  their  GTCG  for  transactions  at  casinos  or  adult 
entertainment  establishments  while  not  in  official  travel  status.  The  DoD  FMR 
states  that  the  GTCC  is  not  for  personal  use  and  travel  cards  are  to  be  used  only  for 
official  travel-related  expenses.  Additionally,  misuse  specifically  includes  ATM  cash 
withdrawals  made  during  nontravel  periods. 

As  indicated  in  the  example  below,  GTCC  transactions  that  occur  outside  of  official 
Government  travel  status  indicate  abuse  of  the  GTCC.  However,  not  all  APCs  had 
access  to  the  travel  systems  to  determine  whether  the  cardholders  were  on  official 
travel  status.  Furthermore,  DTMO  personnel  informed  us  that  the  role  of  an  APC 
was  not  always  a  primary  duty,  and  DoD  management  decided  what  level  of  travel 
system  access  should  be  granted. 

In  our  example,  if  the  CPM  or  APC  had  been  systematically  notified  of  the 
transactions  that  occurred  outside  of  official  Government  travel,  the  CPM  or  APC 
could  have  reviewed  the  transactions,  which  may  have  prevented  the  cardholder 
from  abusing  the  GTCC  for  over  2  years.  The  Director,  DTMO,  should  coordinate 
with  the  Military  Services,  Defense  agencies,  and  Citibank  representatives  to 
determine  what  tools,  techniques,  or  technologies  are  most  appropriate  to  identify 
GTCC  transactions  that  did  not  have  associated  travel  status  in  DTS  or  other 
DoD  travel  systems. 

Defense  Logistics  Agency  Cardholder  Used  the  Government  Travel  Charge 
Card  at  Maryland  Live!  Casino 

A  Defense  Logistics  Agency  (DLA]  civilian  employee  used  the  GTCC  29  times 
between  October  2012  and  September  2014  to  obtain  nearly  $5,000  in  cash  while 
not  in  travel  status.  Of  the  29  transactions,  the  cardholder  had  19  transactions  at 
Maryland  Live!  Casino  in  Hanover,  Maryland,  totaling  $3,366.  The  cardholder  also 
attempted  three  cash  withdrawals  that  were  declined  at  the  casino  totaling  $402. 
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Defense  Logistics  Agency  Management  Actions 

The  DLA  officials  took  action  against  the  cardholder  after  we  informed  them  of 
the  transactions.  During  an  interview  with  the  cardholder’s  CPM  and  supervisor, 
the  CPM  stated  the  cardholder’s  APC  did  not  identify  the  transactions,  and 
DLA  management  was  unaware  until  we  notified  them  of  our  findings.  After  we 
notified  DLA  management,  they  investigated  the  transactions  further,  and: 

•  the  CPM  immediately  deactivated  the  cardholder’s  GTCC; 

•  management  suspended  the  employee  for  3  days  without  pay  after  a  full 
review  and  appeals  process;  and 

•  DLA  officials  removed  the  cardholder’s  APC  from  the  GTCC 
oversight  responsibilities. 

Cash  Withdrawals  That  Exceed  Meal  and  Incidental  Expenses 
While  In  Travel  Status  Could  Indicate  Personal  Use 

DoD  cardholders  made  cash  withdrawals  that  exceeded  their  meals  and 
incidentals  (M&IE]  allotment,  which  could  have  indicated  improper  personal 
use.  However,  the  Director,  DTMO  did  not  have  the  controls  in  place  to  identify 
excessive  withdrawals.  Four  of  the  seven  cardholders  had  transactions  that 
exceeded  the  total  M&IE  allotted  to  each  traveler  for  the  trip.  In  addition,  of  the 
casino  transactions  we  provided  to  the  CPMs  for  review,  673  transactions  for 
$134,864  were  cash  withdrawals  and  exceeded  the  M&IE  allotted  to  each  traveler 
for  the  trip. 

The  DoD  FMR  specifies  that  the  GTCC  is  the  primary  payment  method  for  official 
travel  expenses  incurred  by  DoD  personnel.  The  GTCC  is  not  for  personal  use 
and  may  not  be  used  for  any  individuals  other  than  the  cardholder  and  his  or  her 
authorized  dependents.  Transactions  that  exceed  M&IE  amounts  while  in  travel 
status  could  indicate  personal  use.  However,  according  to  DoD  personnel,  not  all 
APCs  have  access  to  travel  systems  to  identify  cardholders  who  exceed  the  overall 
M&IE  amounts  for  a  trip. 

In  the  example  below,  if  the  CPM  or  APC  had  been  systematically  notified  of  the 
risky  transactions,  the  CPM  or  APC  could  have  reviewed  the  transactions  and  taken 
timely  action.  The  Director,  DTMO,  should  coordinate  with  the  Military  Services, 
Defense  agencies,  and  Citibank  representatives  to  determine  what  tools,  techniques, 
or  technologies  are  most  appropriate  to  identify  GTCC  transactions  that  exceeded 
the  total  M&IE  received  during  official  Government  travel. 
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Navy  Cardholder  Used  Government  Travel  Charge  Card  at  Four  Adult 
Entertainment  Establishments 


1 


A  petty  officer  first  class  from  the  Naval  Special  Warfare  Group  used  the  GTCC  at 

_  multiple  adult  entertainment  establishments  while  on  official 

Government  travel  to  El  Paso,  Texas.  While  in  El  Paso,  the 
cardholder  spent  more  than  six  times  his  total  M&IE  at 
four  different  adult  entertainment  establishments,  which 
included  Dreams  Cabaret,  Jaguars  Gold  Club,  Tequila 
Sunrise,  and  Red  Parrot  Gentlemen’s  Club. 


The 

cardholder 
spent  more  than 
six  times  his  total 
M&IE  at  four  different 
adult  entertainment 
establishments. 


r 


The  petty  officer  only  received  $151.50  in  M&IE  for 
17  days  of  travel  because  his  meals  were  provided,  except 
for  the  first  and  last  day  of  travel.  However,  he  still  incurred 
12  transactions  for  $1,116  at  adult  entertainment  establishments  during  his 
17  days  of  travel.  The  petty  officer  also  charged  an  additional  $642  on  his  GTCC  for 
food,  drinks,  and  ATM  withdrawals  at  locations  that  were  not  adult  entertainment 


establishments.  In  total,  he  spent  $1,758  on  his  GTCC  but  only  received  $151.50 
in  M&IE. 


Navy  Management  Actions 

Navy  officials  took  action  against  the  cardholder  after  we  informed  them  of  the 
transactions.  Based  on  our  discussion  with  the  CPM  and  APC,  neither  the  CPM  nor 
APC  detected  the  transactions.  The  APC  stated  that  the  actions  of  the  cardholder 
were  sent  to  the  disciplinary  review  board  after  we  informed  the  cardholder’s 
supervisor  and  other  Navy  officials  of  the  transactions.  According  to  an  e-mail 
from  the  APC,  the  cardholder  received  written  counseling  for; 

•  misuse  of  GTCC  for  unauthorized  personal  expenses; 

•  withdraws  that  exceeded  cash  limits  established  on  the  card  that  were  not 
necessary  or  reasonable;  and 

•  charges  from  unauthorized  establishments  while  in  El  Paso,  Texas  through 
ATM  withdrawals  at  bars,  taverns,  and  restaurants,  which  exceeded  the 
authorized  per  diem  limit  at  his  travel  location. 

As  a  result  of  the  Disciplinary  Review  Board’s  finding,  the  cardholder  was 
required  to: 

•  complete  Travel  Card  101  training, 

•  sign  and  date  a  new  statement  of  understanding  for  the  GTCC,  and 

•  provide  a  general  military  training  session  to  his  department  and  division 
personnel  for  proper  use  of  the  GTCC  in  accordance  with  DoD  Directives. 
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Using  Merchant  Names  Could  Assist  Agency  Program 
Coordinators  to  Identify  Potential  Personal  Use 

APCs  either  did  not  identify  improper  personal  use  by  reviewing  the  merchant 
names  or  could  not  determine  the  type  of  establishments  by  reviewing  the 
merchant  names.  Also,  the  DTMO  Travel  Policy  Compliance  Tool  did  not  data  mine 
for  casino  or  adult  entertainment  establishments’  merchant  names  to  identify 
personal  use. 


Four  of  the  seven  cardholders  reviewed  had  GTCC  transactions 
at  several  adult  entertainment  establishments,  including: 


Dreams  Cabaret  for  $308; 

Vegas  Showgirls  for  $2,100; 

Larry  Flynt’s  Hustler  Club  for  $1,614;  and 
Sapphire  Gentlemen’s  Club  for  $4,686. 


i 


Ik 


Cardholders 
used  their  GTCC 
at  Dreams  Cabaret, 
Vegas  Showgirls, 
Larry  Flynt’s  Hustler 
Club,  and  Sapphire 
Gentlemen’s 
Club. 


i 


i 


The  method  DoD  used  to  block  the 

Merchant  Category  Codes  (MCCs)^  was  not 
effective  to  prevent  personal  use  of  the  GTCC  at  casinos  and 
adult  entertainment  establishments.  The  MCCs  identified 
with  the  purchases  were  either  ATM  transactions  or 
restaurant  purchases.  DoD  coordinated  with  Citibank  to 
prevent  the  use  of  the  GTCC  at  specific  types  of  merchants 
by  using  the  MCC.  CPMs  and  APCs  relied  on  blocked  MCCs  to 
ensure  cardholders  did  not  use  their  GTCCs  at  unauthorized 
locations,  such  as  adult  entertainment  establishments. 


The 

method  DoD 
used  to  block 
the  MCCs  was  not 
effective  to  prevent 
personal  use 


Many  adult  entertainment  establishments  can  circumvent  the  blocked  MCC  by 
using  a  MCC  related  to  ATMs,  bars,  or  restaurants  to  disguise  the  true  nature  of  the 
business.  In  addition,  casinos  and  adult  entertainment  establishments  may  appear 
on  GTCC  billing  statements  under  a  variety  of  names. 

Casinos  and  casino-processing  companies  cannot  be  blocked  by  MCC  because 
travelers  may  use  these  locations  for  legitimate  travel  expenses.  DoD  had 
24,119  transactions  that  occurred  at  casinos  and  casino  processing  centers; 
however,  not  all  transactions  at  casinos  represent  personal  use.  During  interviews, 
several  APCs  stated  they  may  not  have  been  aware  that  transactions  were 
occurring  at  casinos  because  of  the  merchant  name  that  appeared  on  the 
GTCC  billing  statement. 


^  An  MCC  is  a  four-digit  number  assigned  to  a  business  by  MasterCard  or  Visa  when  the  business  first  starts  accepting 
one  of  these  cards  as  a  form  of  payment.  The  MCC  is  used  to  classify  a  business  by  the  type  of  goods  or  services 
provided.  The  Department  blocks  some  MCCs  to  prevent  inappropriate  card  use. 
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For  example,  DiTRONICS  Financial  Services  provided  cash  access  services  and 
ticket  redemption  kiosks  to  casinos,  and  DiTRONICS  was  the  merchant  name  on 
the  billing  statement.  Unless  the  ARC  or  other  reviewing  officials  were  aware  that 
DiTRONICS  was  a  specific  cash  access  service  for  casinos,  they  would  not  know  to 
question  the  transactions  that  occurred. 

CPMs  and  APCs  cannot  be  expected  to  know  the  names  of  all  adult  entertainment 
establishments  and  casinos  or  casino-processing  centers.  The  Director,  DTMO, 
should  coordinate  with  the  Military  Services,  Defense  agencies,  and  Citibank 
representatives  to  determine  what  tools,  techniques,  or  technologies  are  most 
appropriate  to  indicate  GTCC  transactions  that  occur  at  specific  known  casino 
and  adult  entertainment  establishments.  In  addition,  the  Director,  DTMO,  should 
coordinate  with  the  General  Services  Administration  to  determine  whether 
Citibank  should  be  required  to  block  usage  of  the  Government  travel  charge  card 
at  specific  casino  locations  or  adult  entertainment  establishments  known  for 
personal  use. 

Multiple  Declined  Authorizations  Could  Indicate  Personal  Use 

DTMO  personnel  did  not  provide  an  automated,  real-time  notification  of  high-risk 
declined  transactions  to  APCs.  Six  of  the  seven  cardholders  reviewed  had  declined 
authorizations.  Citibank  Custom  Reporting  System  contains  a  standard  report  that 
can  be  run  to  identify  declined  authorizations  within  a  given  hierarchy.  The  report 
lists  all  transactions  attempted  but  declined  against  an  account  and  details  the 
reasons  the  transaction  was  declined  and  type  of  purchase  attempted. 

As  shown  in  the  example  below,  declined  authorizations  may  indicate  personal  use. 
Although  Citibank  made  this  report  available  to  the  APCs,  they  were  not  required 
to  generate  it  for  review.  In  addition,  the  DoD  FMR  does  not  require  CPMs  or  APCs 
to  review  the  Declined  Authorizations  Report. 

When  cardholders  use  their  GTCCs  for  personal  use,  the  individuals  are  more  likely 
to  have  multiple  declined  authorizations.  The  Director,  DTMO,  should  coordinate 
with  the  Military  Services,  Defense  agencies,  and  Citibank  representatives  to 
review  the  reasons  for  declined  authorizations  and  to  determine  what  tools, 
techniques,  or  technologies  are  most  appropriate  to  identify  GTCC  declined 
authorization  activity  that  could  indicate  personal  use. 
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Army  Cardholder  Used  Government  Travel  Charge  Card  at 
Pechanga  Resort  and  Casino 

An  Army  Reserve  sergeant  first  class  with  the  416th  Civil  Affairs  Battalion  abused 
the  GTCC  at  Pechanga  Resort  and  Casino  in  Temecula,  California,  which  was  only 
8.6  miles  from  his  residence.  From  March  1,  2011,  through  October  12,  2014,  the 
cardholder  had  83  transactions  at  Pechanga  Resort  and  Casino  that  totaled  $16,415. 

The  majority  of  the  transactions  occurred  while  the  cardholder  was  not  on  official 
Government  travel.  In  addition,  the  cardholder  had  90  declined  transactions  from 
March  1,  2011,  through  October  16,  2014,  totaling  $14,478.  Citibank  declined  the 
transactions  for  multiple  reasons,  four  of  which  indicated  potential  personal  use:® 

•  18  transactions,  totaling  $2,530,  were  declined  because  the  card 
was  deactivated, 

•  8  transactions,  totaling  $1,392,  were  declined  for  reaching  the  daily 
ATM  dollar  limit, 

•  5  transactions,  totaling  $520,  were  declined  for  reaching  the  daily 
ATM  transaction  limit,  and 

•  57  transactions,  totaling  $9,768,  were  declined  for  exceeding  the 
card’s  credit  limit. 

The  cardholder  also  showed  a  pattern  in  his  declined  authorizations.  On  several 
occasions  after  the  initial  declined  transactions,  the  cardholder  reduced  the 
amount  requested  until  the  individual  successfully  obtained  cash.  For  example,  on 
May  28,  2013,  the  cardholder  had  six  declined  authorizations  within  13  minutes. 
After  successfully  withdrawing  $204  at  the  casino.  Citibank  declined  an  attempt 
to  withdraw  another  $204  because  the  cardholder  did  not  have  enough  available 
credit.  The  cardholder  then  attempted  to  withdraw  $184,  $164,  $164,  $144,  and 
$104  within  that  13-minute  period.  All  requests  were  declined  because  of  the  lack 
of  available  credit. 

Army  Management  Actions 

Army  officials  took  management  action  against  the  cardholder  after  we  informed 
them  of  the  transactions.  A  commander’s  inquiry  determined  that  the  cardholder 
would  receive  a  letter  of  reprimand.^  Neither  the  CPM  nor  APC  were  aware  of  the 
cardholder’s  personal  use  of  the  GTCC. 


^  Two  transactions,  totaling  $268,  were  declined  for  invalid  personal  identification  number.  We  did  not  consider  this 
reason  to  be  an  indicator  of  personal  use. 

^  A  form  of  administrative  punishment. 
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Government  Travel  Charge  Card  Activity  Outside  of  Official 
Travel  Location  Couid  Indicate  Personal  Use 

DoD  cardholders  improperly  used  the  GTCC  while  on  official  travel  for  personal  use 
in  locations  other  than  the  city  or  surrounding  area  of  their  travel;  however,  the 
Director,  DTMO  did  not  have  controls  in  place  to  detect  these  transactions.  Of  the 
seven  cardholders  reviewed,  two  used  the  GTCC  in  locations  other  than  the  city  or 
surrounding  area  of  their  travel.  In  some  cases,  the  casinos  where  the  GTCC  was 
used  were  more  than  an  hour  away  from  the  official  temporary  duty  (TDY)  location 
or  near  the  individual’s  home  residence.  The  DoD  FMR  specifically  states  that  the 
GTCC  should  only  be  used  while  on  official  orders  and  performing  duties  pertaining 
to  official  Government  assignments. 

APCs  and  cardholder  supervisors  could  take  timely  corrective  action,  including 
deactivating  the  card  or  disciplining  cardholders  who  abuse  the  GTCC,  if 
DoD  had  a  systematic  way  to  identify  transactions  for  review.  The  Director, 

DTMO,  should  coordinate  with  the  Military  Services,  Defense  agencies,  and 
Citibank  representatives  to  determine  what  tools,  techniques,  or  technologies 
are  most  appropriate  to  identify  GTCC  activity  outside  the  official  government 
travel  locations. 

Air  Force  Cardholder  Used  Government  Travel  Charge  Card  at 
Ultron  Casino  ATM 

A  U.S.  Air  Force  civilian  employee  from  Warner  Robbins  Air  Force  Base,  Georgia 
traveled  300  miles  (round  trip)  from  his  travel  location  and  used  his  GTCC  at  a 
casino.  The  cardholder  was  on  official  Government  travel  to  Hill  Air  Force  Base, 
Utah  and  used  his  GTCC  at  Ultron  ATMs  in  West  Wendover,  Nevada.^  Ultron  ATMs 
are  predominately  associated  with  casinos  throughout  the  United  States. 

On  four  occasions,  the  cardholder  used  his  GTCC  seven  times  at  the  West  Wendover 
location  to  withdraw  over  $1,500  from  ATMs  at  a  casino  where  he  had  nine 
declined  transactions  totaling  $2,363.  The  APC  stated  that  he  noticed  the 
Ultron  ATM  withdrawals  while  performing  his  review  of  the  activity  and  spoke  to 
the  cardholder  at  the  time.  He  could  not  remember  any  details  of  the  conversation, 
but  indicated  that  he  found  nothing  improper  with  the  transactions. 

As  a  result  of  our  audit,  the  human  resources  supervisor  performed  an  updated 
interview  of  the  cardholder  on  October  28,  2014.  During  the  interview,  the 
cardholder  stated  that  he  obtained  the  $1,500  in  cash  in  West  Wendover,  Nevada 
to  pay  for  food  and  drinks  while  he  attended  car  races,  shows,  and  local  events. 

The  cardholder  denied  that  he  used  the  money  to  gamble  at  casinos. 


West  Wendover  is  a  destination  resort  community  that  is  located  on  the  Nevada-Utah  border  and  has  five  prominent 
gambling  establishments. 
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Air  Force  Management  Actions 

Air  Force  officials  did  not  take  disciplinary  action  against  the  cardholder  after  we 
informed  them  of  the  transactions.  Although  the  human  resource  supervisor  could 
not  conclude  that  the  cardholder  used  his  GTCC  for  gambling  purposes  at  a  casino, 
he  concluded  that  the  cardholder  used  his  GTCC  for  personal  use  and  should  have 
been  disciplined.  However,  members  of  the  Employee  Relations  Board  stated  they 
could  not  take  disciplinary  action  because  of  the  time  that  had  passed  since  the 
unauthorized  use.  The  board  stated  that  in  accordance  with  the  employee’s  labor 
agreement  the  cardholder’s  supervisor  should  have  investigated  the  misconduct 
and  submitted  his  findings  to  the  Employee  Relations  Board  within  45  days  from 
the  time  of  the  occurrence  or  identification  of  potential  misuse. 

If  the  ARC  would  have  identified  the  transactions  and  properly  investigated,  then 
the  Employee  Relations  Board  could  have  taken  appropriate  disciplinary  actions 
within  the  required  time  frames. 


Defense  Travel  Management  Office  Needs  to  Update 
the  DoD  Financial  Management  Regulation 

DTMO  personnel  have  not  provided  sufficient  guidance  through  the  DoD  FMR  to 
detect  DoD  personnel  that  improperly  used  the  GTCC  for  personal  use  at  casinos 
and  adult  entertainment  establishments.  Specifically,  the  DoD  FMR  does  not: 

•  prohibit  merchant  types  that  should  be  considered  high  risk  for  personal 
use  such  as  casinos  and  adult  entertainment  establishments; 

•  require  APCs  to  review  the  declined  authorization  report  for  suspicious 
activity;  and 

•  require  APCs  to  use  the  Visa  IntelliLink  tool  to  assist  in  their  reviews  of 
monthly  GTCC  activity  for  personal  use  or  other  misuse. 


Prohibit  High-Risk  Merchants 

Although  DTMO  took  action  to  block  specific  MCCs,  it  did  not  provide  detailed 
guidance  on  the  merchant  types  that  should  not  be  visited  by 
DoD  employees.  Several  APCs  expressed  concern  that  ^ 

DoD  policy  did  not  specifically  prohibit  merchant  types 
that  should  be  considered  high  risk  for  personal  use 
such  as  casinos  or  adult  entertainment  establishments. 

One  APC  indicated  concern  over  disciplining 
cardholders  when  DoD  guidance  did  not  specifically 
prohibit  adult  entertainment  establishments.  The 


APCs 
expressed 
concern  that 
DoD  policy  did  not 
specifically  prohibit 
merchant  types  that 
should  be  considered 
high  risk  for 
personal  use. 
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Director,  DTMO,  should  revise  DoD  FMR  Volume  9,  Chapter  3  to  include  examples  of 
merchant  categories  that  are  considered  high  risk  for  personal  use  such  as  casinos 
and  adult  entertainment  establishments. 

Require  Review  of  Declined  Authorizations  Report 

Six  of  the  seven  cardholders  had  declined  transactions,  which  showed  that  declined 
authorizations  were  a  good  indicator  of  personal  use.  Citibank  Custom  Reporting 
System  contains  a  declined  authorizations  report  that  all  APCs  could  generate  for 
their  hierarchy;  however,  the  APCs  were  not  required  to  run  or  review  the  report. 
The  DoD  FMR  states  that  the  declined  authorizations  report  lists  all  transactions 
attempted  but  declined  against  an  account.  It  also  details  the  reasons  for  decline 
and  type  of  purchase,  but  states  that  APC  review  of  the  report  is  optional.  The 
Director,  DTMO,  should  require  APCs  to  review  the  declined  authorization  report  at 
least  monthly  for  suspicious  activity. 

Provide  APCs  Access  to  Visa  IntelliLink  and  Require  Its  Use 

The  DoD  FMR  states  that  APCs  use  of  Visa’s  data  mining  tools  to  gather  and 
analyze  GTCC  data  and  identify  incidents  of  suspected  misuse  is  optional.  We  used 
Visa  IntelliLink  as  a  data  mining  tool  to  locate  the  transactions  we  reviewed  and 
sent  to  the  CPMs  for  review.  The  Director,  DTMO,  should  require  APCs  to  use  the 
Visa  IntelliLink  tool  to  assist  in  their  reviews  of  monthly  GTCC  activity  for  personal 
use  or  other  misuse. 


Citibank  Not  Required  to  Notify  the  Agency  Program 
Coordinator  of  Fraudulent  Activity  or  Suspension  of 
Travel  Cards 


APCs  were  unaware  of  fraudulent  activity  identified  by  Citibank  or  its  suspension 
of  GTCC  accounts  because  Citibank  was  not  required  to  alert  them.  Under  the 


Citibank 
was  not 
required  to  notify 
the  CPM  or  APC  of 
potentially  fraudulent 
activity  or  suspension 
of  a  cardholder’s 
account. 


contract.  Citibank  was  not  required  to  notify  the  CPM  or 
^  APC  of  potentially  fraudulent  activity  or  suspension  of 
a  cardholder’s  account.  If  Citibank  would  have  been 
required  to  notify  Air  Force  officials  of  the  suspicious 
activity  in  the  example  below,  then  they  could  have 
detected  the  personal  use  earlier.  It  would  have  also 
reduced  the  possibility  that  if  the  cardholder  had 
paid  the  full  balance  before  reactivation,  then  the  APC 
would  not  have  identified  the  abuse.  The  Director,  DTMO, 


f 


should  coordinate  with  GSA  to  determine  whether  the  Citibank 


contract  should  be  modified  to  require  Citibank  to  notify  a  cardholder’s  CPM  or 
APC  of  potential  fraudulent  use  or  suspension  of  travel  cards. 
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Air  Force  Cardholder  Used  Government  Travel  Charge  Card  at 
Sapphire  Gentlemen's  Club 


A  senior  airman  from  the  4th  Aircraft  Maintenance  Squadron  at  Seymour  Johnson 
Air  Force  Base,  North  Carolina  used  the  GTCC  for  personal  use  while  on  official 


Government  travel  to  Nellis  Air  Force  Base,  Nevada  near  Las  Vegas. 


The  cardholder’s  total  per  diem  for  the  travel  was  $359.25. 
During  his  travel,  the  cardholder  had  three  purchases  at 
Sapphire  Gentlemen’s  Club  totaling  $4,686.  In  addition. 
Citibank  declined  another  GTCC  transaction  for  $920 
because  the  transaction  would  have  exceeded  his  card’s 
credit  limit.  The  cardholder  later  admitted  that  he  used 
his  GTCC  at  the  Sapphire  Gentlemen’s  Club  VIP  room  for 
himself  and  several  friends. 


The 

cardholder 
later  admitted  that 
he  used  his  GTCC 
at  the  Sapphire 
Gentlemen’s  Club 
VIP  room. 


As  a  result  of  the  Squadron’s  policy  to  deactivate  GTCCs  while  not  in  travel  status 
and  reactivating  the  GTCC  when  necessary,  the  Air  Force  resource  advisor  detected 
the  transactions  when  reactivating  the  GTCC.  Although  the  resource  advisor 
detected  the  transactions,  it  was  about  48  days  after  the  transactions  occurred. 
Additionally,  the  resource  advisor  only  detected  the  transactions  when  activating 
the  GTCC  for  an  upcoming  trip  and  noted  the  cardholder  had  a  delinquent 
balance  of  $4,923.  After  contacting  Citibank  officials.  Citibank  officials  informed 
the  resource  advisor  that  they  notified  the  cardholder  of  potentially  fraudulent 
activity  on  the  GTCC,  and  the  cardholder  informed  Citibank  officials  that  the 
transactions  were  valid.  The  Director,  DTMO,  should  determine  the  feasibility  of 
deactivating  travel  cards  and  reducing  travel  card  limits  for  cardholders  while  not 
on  official  travel. 


Air  Force  Management  Actions 

The  Air  Force  officials  took  action  against  the  cardholder  after  they  identified 
the  transactions.  The  Resource  Advisor  identified  potentially  unauthorized 
transactions  and  notified  the  cardholder  and  his  supervisor.  The  cardholder’s 
supervisors  conducted  a  review  and  determined  the  transactions  were  for  personal 
use.  As  a  result,  the  cardholder  was  issued  an  Article  15^^  and  reduced  his  rank 
from  senior  airman  (E-4)  to  airman  first  class  (E-3). 


A  form  of  administrative  punishment. 
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Management  Actions 

For  the  seven  cardholders  reviewed,  management  confirmed  that  the  transactions 
we  identified  were  personal  use  of  the  GTCC  and  confirmed  the  misuse  or  abuse 
that  our  analysis  detected. 

On  October  23,  2014,  we  provided  the  CPMs  at  each  Military  Service  a  list  of 
886  transactions  related  to  adult  entertainment  establishments,  valued  at  $95,031, 
that  we  identified  using  Visa  IntelliLink.  We  received  responses  from  the  Services 
from  December  2014  through  February  2015.  A  summary  of  their  reviews  is 
provided  in  Table  2. 


Table  2.  Results  from  Military  Service  CPM  and  APC's  review  of  Adult  Entertainment 
Establishment  Transactions 


Service 

Action 

Taken^ 

Pending 

No  Action 
Taken  with 
Reason^ 

No  Action 
Taken^ 

Transaction 

Not 

Reviewed 

Total 

Army 

146 

31 

40 

117 

31 

365 

Navy 

66 

15 

6 

19 

1 

107 

Air  Force 

138 

22 

24 

97 

66 

347 

Marine 

Corps 

17 

11 

4 

19 

16 

67 

Total 

367 

79 

74 

252 

114 

886 

^  Actions  taken  include  counseling,  training,  letters  of  reprimand,  and  reduction  in  rank. 

^  No  action  taken  because  cardholder  either  separated  from  the  command,  retired,  or  successfully  disputed  the  charge 
with  Citibank. 

^  APCs  reviewed  these  transactions,  but  no  action  was  taken  for  reasons  including:  the  cardholder  did  not  know  it  was 
an  adult  establishment,  ''transactions  not  unauthorized,"  or  the  APC  stated  that  the  cardholder  was  TDY  during  the 
transaction  (implying  that  personal  use  cannot  happen  while  on  TDY). 

On  December  24,  2014,  we  provided  the  CPMs  at  each  Military  Service  a  list  of 
4,336  transactions,  valued  at  $927,358,  that  were  high  risk  for  personal  use  at 
casinos  or  casino-processing  centers  by  using  Visa  IntelliLink  and  DTMO  data.  In 
addition  in  January  2015,  we  provided  DLA,  Defense  Contract  Management  Agency, 
and  Defense  Threat  Reduction  Agency  lists  of  high-risk  transactions  from  their 
agency.  In  total,  the  three  agencies  had  56  high-risk  transactions,  valued  at 
$15,458  at  casinos  or  casino  processing  centers.  We  received  responses  on  a  draft 
of  this  report  from  the  Service  CPMs  regarding  their  reviews  of  high  risk 
transactions  that  were  not  complete  or  sufficient.  Therefore,  CPMs  at  each  Military 
Service  should  complete  their  reviews  of  the  transactions  and  provide  the  results 
of  the  review  to  us  no  later  than  June  30,  2015. 
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Conclusion 

The  CPMs  and  APCs  did  not  detect  when  DoD  personnel  improperly  used  their 
GTCC  for  personal  use  at  casinos  and  adult  entertainment  establishments.  From 
July  1,  2013,  through  June  30,  2014,  DoD  cardholders  had  4,437^^  transactions, 
totaling  $952,258,  where  they  likely  used  their  travel  cards  for  personal 
use  at  casinos  and  had  900  additional  transactions  for  $96,576  at  adult 
entertainment  establishments. 

Unless  DTMO  and  the  CPMs  improve  oversight  actions,  improve  internal  controls 
of  the  GTCC  program,  and  provide  written  prohibition  of  personal  use  of  the  GTCC 
at  casinos  and  adult  entertainment  establishments,  DoD  personnel  may  continue  to 
use  their  GTCCs  for  personal  use  at  these  establishments.  Furthermore,  APCs  will 
not  have  the  tools  to  allow  for  automated  detection  of  personal  use  transactions 
from  the  millions  of  GTCC  transactions  each  year. 

Management  Comments  on  the  Finding 
and  Our  Response 

Defense  Travel  Management  Office  Comments 

The  Director;  Defense  Travel  Management  Office  stated  that  the  report  does  not 
call  attention  to  the  strength  of  the  DoD  Government  Charge  Card  program  and 
that  personal  use  is  negligible  compared  to  the  size  and  scope  of  the  program.  The 
Director  supports  the  strength  of  the  program  by  stating  the  delinquency  rate  for 
individually  billed  accounts  was  1  percent  for  FY15  second  quarter  and  was  much 
lower  than  the  industry  average  of  4  percent.  He  also  states  that  the  personal  use 
identified  in  the  report  is  less  than  0.5  percent  of  the  total  transactions  and  dollars 
spent  on  individually  billed  accounts.  Finally,  the  Director  stated  that  personal  use 
does  not  result  in  the  loss  of  U.S.  taxpayer  dollars  because  the  cardholder  is  not 
reimbursed  for  the  expenses. 

Our  Response 

The  overall  objective  of  the  audit  was  to  determine  whether  DoD  Government 
travel  charge  card  holders  used  their  card  for  personal  use  at  casinos  or  adult 
entertainment  establishments.  Therefore,  the  audit  team  cannot  draw  conclusions 
on  the  overall  personal  use  of  the  GTCC  program  or  the  overall  strength  of 
the  program. 


This  includes  transactions  for  organizations  that  do  not  use  Defense  Travel  System  such  as  U.S.  Army  Corps  of 
Engineers  and  U.S.  Air  Force  Reserve. 


DODIG-2015-125  |  19 


Finding 


Recommendations,  Management  Comments, 
and  Our  Response 

Recommendation  l.a 

We  recommend  that  the  Director,  Defense  Travel  Management  Office: 

Establish  a  working  group  with  the  Military  Services,  Defense  agencies,  and 
bank  representatives  to  determine  what  tools,  techniques,  or  technologies  are 
most  appropriate  to  prevent  or  identify  personal  use  of  the  Government  travel 
charge  card  at  casinos  and  adult  entertainment  establishments.  Specifically 
the  tools,  techniques  or  technologies  should  enable  Agency  Program 
Coordinators  to  identify: 

1.  Travel  card  transactions  that  do  not  have  associated  travel  status  in 
Defense  Travel  System  or  other  DoD  travel  systems; 

2.  Automated  teller  machine  withdrawals  that  exceed  the  overall  meal 
and  incidental  expense  amounts  while  in  a  travel  status; 

3.  Travel  card  transactions  that  occur  at  specific  known  casinos,  casino¬ 
processing  centers,  and  adult  entertainment  establishments; 

4.  Travel  card  declined  authorization  activity  that  could  indicate 
personal  use;  and 

5.  Travel  card  activity  outside  the  official  Government  travel  location. 

Defense  Travel  Management  Office  Comments 

The  Director,  Defense  Travel  Management  Office,  agreed,  but  stated  that  a  specific 
working  group  does  not  need  to  be  established  to  determine  what  tools,  techniques, 
or  technologies  are  most  appropriate  to  prevent  or  identify  personal  use  of  the 
Government  Travel  Charge  Card  (GTCC].  The  Director  stated  that  DTMO  actively 
engages  with  CPMs  and  Citibank  on  a  daily  basis  as  well  as  through  quarterly 
meetings  and  program  reviews. 

The  Director  stated  that  DTMO  conducted  refresher  training  on  the  Citibank 
Customer  Reporting  System  and  Visa  IntelliLink  to  identify  potential  personal 
use  of  the  card  and  plans  to  include  a  training  course  for  the  APCs  on  the 
use  of  the  tools  at  the  GSA  SmartPay  Forum.  He  also  indicated  that  DTMO 
created  new  reports  in  Visa  IntelliLink  to  identify  use  at  casinos  and  adult 
entertainment  establishments. 
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The  Director  stated  that  DTMO  specifically  designed  and  developed  the 
Compliance  Tool  to  identify  and  assist  with  the  recovery  of  improper  or  overpaid 
travel  reimbursements  (or  both).  He  continued  by  stating  that  there  would  not  be 
a  return  on  investment  if  DTMO  enhanced  the  tool  to  identify  personal  use  of  the 
travel  card. 

Our  Response 

Comments  from  the  Director,  Defense  Travel  Management  Office  partially 
addressed  the  recommendation.  Although  the  Director  did  not  agree  to  establish 
a  working  group,  he  did  agree  to  engage  with  the  CPMs  and  Citibank.  He  also 
referenced  a  focus  on  improved  and  more  prevalent  usage  of  the  Citibank  Customer 
Reporting  System  and  Visa  IntelliLink  to  identify  potential  personal  use  of  the  card, 
specifically  related  to  casinos  and  adult  entertainment  establishments. 

Although  we  recognize  the  potential  the  Compliance  Tool  has  to  identify  personal 
use  of  the  GTCC,  we  recommended  that  the  Director,  in  coordination  with  other 
key  stakeholders,  determine  what  tools,  techniques,  or  technologies  are  most 
appropriate  to  prevent  or  identify  personal  use  of  the  Government  travel  charge 
card  at  casinos  and  adult  entertainment  establishments.  While  the  Director’s 
response  partially  addressed  the  recommendation,  he  did  not  address  the  types  of 
tools,  techniques,  or  technologies  he  considered  to  identify: 

•  Travel  card  transactions  that  do  not  have  associated  travel  status  in 
Defense  Travel  System  or  other  DoD  travel  systems; 

•  Automated  teller  machine  withdrawals  that  exceed  the  overall  meal 
and  incidental  expense  amounts  while  in  a  travel  status; 

•  Travel  card  declined  authorization  activity  that  could  indicate  personal 
use;  or 

•  Travel  card  activity  outside  the  official  Government  travel  location. 

Therefore,  we  ask  that  the  Director  provide  additional  comments  in  response  to  the 
final  report  that  describes  the  specific  tools,  techniques,  or  technologies  that  would 
identify  the  transactions  outlined  in  the  recommendation. 
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Recommendation  l.b 

Determine  the  feasibility  of  deactivating  travel  cards  and  reducing  travel  card 
limits  for  cardholders  while  not  on  official  travel. 

Defense  Travel  Management  Office  Comments 

The  Director,  Defense  Travel  Management  Office,  agreed,  stating  that  the  current 
DoD  and  0MB  policy  is  to  deactivate  restricted  accounts  for  cardholders  not  in  a 
travel  status.  He  stated  that  DTMO  personnel  are  currently  working  with  Citibank 
and  the  CPMs  to  improve  enforcement  of  the  policy. 

Our  Response 

Comments  from  the  Director  partially  addressed  the  recommendation.  While 
we  commend  the  Director  for  having  the  policy  in  place  to  deactivate  restricted 
accounts,  there  is  a  benefit  to  deactivate  all  cardholder  accounts  that  are  not  in 
an  official  travel  status.  Therefore,  we  ask  that  the  Director  provide  additional 
comments  on  the  feasibility  of  a  systematic  process  to  deactivate  all  DoD  travel 
cards  for  cardholders  who  are  not  in  an  official  travel  status. 

Recommendation  l.c 

Revise  the  DoD  Financial  Management  Regulation,  volume  9,  chapter  3  to 
include  examples  of  merchant  categories  that  are  considered  high  risk  for 
personal  use,  such  as  casinos  and  adult  entertainment  establishments. 

Defense  Travel  Management  Office  Comments 

The  Director,  Defense  Travel  Management  Office,  disagreed,  stating  that  the 
DoD  FMR,  Volume  9,  Chapter  3  clearly  prohibits  card  use  for  other  than  official 
authorized  expenses  in  support  of  official  travel. 

Our  Response 

Comments  from  the  Director  partially  addressed  the  recommendation.  We  agree 
that  the  DoD  FMR,  Volume  9,  Chapter  3,  clearly  prohibits  personal  use.  However, 
DoD  GTCC  officials  indicated  during  the  audit  that  the  policy  needed  to  specifically 
prohibit  the  personal  use  at  casinos  and  adult  entertainment  establishments,  so  the 
APCs  may  hold  commanders  accountable. 

The  Director  provided  a  draft  of  DoD  Instruction  5154.31,  which  is  scheduled  to 
replace  DoD  FMR,  Volume  9,  Chapter  3.  Upon  reviewing  the  updated  draft  policy, 
we  determined  that  while  the  policy  does  not  specifically  mention  casinos  and  adult 
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entertainment  establishments,  it  does  provide  added  emphasis  of  the  prohibition  of 
personal  use  at  establishments  inconsistent  with  official  DoD  business: 

It  is  DoD  policy  that  improper,  fraudulent,  abusive,  or  negligent  use 
of  a  travel  card  is  prohibited.  This  includes  any  use  of  a  travel  card 
at  establishments  or  for  purposes  that  are  inconsistent  with  the 
official  business  of  DoD  or  with  applicable  regulations. ..In  addition, 
civilian  personnel  who  fail  to  satisfy  an  indebtedness  arising  from 
the  use  of  a  travel  card  or  those  who  fail  to  do  so  in  a  timely  manner 
may  be  subject  to  corrective  or  disciplinary/adverse  action.  The 
intent  is  to  ensure  that  management  emphasis  is  given  to  personal 
accountability  for  travel  card  misuse. 

While  we  understand  there  are  legitimate  uses  of  the  GTCC  at  casinos,  we 
believe  the  updated  policy  provides  the  APCs  with  the  guidance  necessary  to 
hold  commanders  accountable.  We  request  that  the  Director  provide  the  date  of 
issuance  for  the  updated  DoD  Instruction. 

Recommendation  l.d.l 

Require  Agency  Program  Coordinators  to  review  the  declined  authorization 
report  at  least  monthly. 

Defense  Travel  Management  Office  Comments 

The  Director,  Defense  Travel  Management  Office,  disagreed,  stating  that  the 
declined  authorization  report  is  not  a  viable  tool  to  identify  personal  use.  The 
Director  also  stated  that  the  report  would  be  difficult  and  time  consuming  for 
an  APC  to  review  and  extract  information  from  it  that  would  indicate  improper 
personal  use. 

Our  Response 

Comments  from  the  Director  did  not  address  the  specifics  of  the  recommendation. 
We  disagree  that  the  declined  authorization  report  is  not  a  viable  tool  to  identify 
personal  use.  For  example,  six  of  the  seven  cardholders  reviewed  included  declined 
transactions  related  to  attempted  personal  use.  If  DTMO  officials  work  with 
Citibank  and  the  CPMs  to  determine  the  reason  codes  related  to  personal  use 
within  the  declined  authorization  report  (for  example,  blocked  merchants,  daily 
ATM  limit,  or  not  enough  available  funding],  the  APCs  would  not  spend  excessive 
amounts  of  time  to  extract  the  information  needed  to  detect  personal  use. 
Therefore,  we  request  that  the  Director  provide  additional  information,  or  propose 
an  alternative  course  of  action,  on  how  APCs  can  get  the  information  they  need  to 
periodically  review  declined  transactions. 
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Recommendation  l.d.2 

Require  Agency  Program  Coordinators  to  use  the  Visa  IntelliLink  tool  to 
assist  in  the  reviews  of  monthly  Government  travel  charge  card  activity  for 
personal  use  or  other  misuse. 

Defense  Travel  Management  Office  Comments 

The  Director,  Defense  Travel  Management  Office,  agreed,  stating  that  Visa  IntelliLink 
is  a  valuable  tool  for  providing  information  regarding  potential  personal  use  or 
misuse.  However,  the  Director  also  stated  that  Citibank  Custom  Reporting  System  is 
another  valuable  tool  that  provides  this  information.  DTMO  does  not  want  to  limit 
the  APCs  by  requiring  one  tool  over  another,  but  the  updated  draft  policy  will  require 
APCs  to  use  either  Visa  IntelliLink  or  Citibank  Custom  Reporting  System. 

Our  Response 

Comments  from  the  Director  partially  addressed  the  recommendation.  We  agree 
that  the  Citibank  Custom  Reporting  System  and  Visa  IntelliLink  are  both  valuable 
tools,  but  disagree  that  requiring  the  use  of  Visa  IntelliLink  would  limit  an  APC’s 
use  of  the  other  tools.  The  Visa  IntelliLink  system  includes  unique  features 
including  a  risk  predictor  score  that  identifies  high-risk  transactions,  as  well  as 
a  case  disposition  tracking  system  for  those  high-risk  transactions.  Neither  of 
those  functions  are  available  in  the  Citibank  system.  Also,  the  Director  referenced 
new  reports  in  Visa  IntelliLink  that  were  designed  to  identify  use  at  casinos  and 
adult  entertainment  establishments,  which  the  APCs  should  be  required  to  review 
on  a  monthly  basis.  Therefore,  we  request  that  the  Director  provide  additional 
information,  or  propose  an  alternative  course  of  action,  on  how  the  use  of  Citibank 
Custom  Reporting  System  will  provide  all  information  available  in  Visa  IntelliLink. 

Recommendation  l.e.l 

Coordinate  with  the  General  Services  Administration  to  determine  whether 
the  Citibank  contract  should  be  modified  to  require  Citibank  to  block  usage 
of  the  Government  travel  charge  card  at  specific  casino  locations  or  adult 
entertainment  establishments. 

Defense  Travel  Management  Office  Comments 

The  Director,  Defense  Travel  Management  Office,  agreed,  stating  that  DTMO 
will  coordinate  with  GSA  to  determine  whether  the  Citibank  contract  should 
be  modified. 

Our  Response 

Comments  from  the  Director  addressed  the  recommendation,  and  no  further 
comments  are  required. 
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Recommendation  l.e.2 

Coordinate  with  the  Generai  Services  Administration  to  determine  whether 
the  Citibank  contract  should  be  modified  to  require  Citibank  to  notify 
Component  Program  Managers  or  Agency  Program  Coordinators  of  potential 
fraudulent  use  or  suspension  of  travel  cards. 

Defense  Travel  Management  Office  Comments 

The  Director,  Defense  Travel  Management  Office,  agreed,  stating  that  DTMO  will 
coordinate  with  GSA  and  discuss  with  Citibank  on  whether  it  is  possible  and 
feasible  to  modify  the  contract. 

Our  Response 

Comments  from  the  Director  addressed  the  recommendation,  and  no  further 
comments  are  required. 

Recommendation  2 

We  recommended  that  the  Army  Component  Program  Manager  complete  a 
review  of  the  casino  transactions  and  provide  the  results  of  the  review  to  us 
no  later  than  April  8,  2015. 

Army  Comments 

The  Deputy  Assistant  Secretary  of  the  Army,  Financial  Operations,  responding 
for  the  Army  Component  Program  Manager,  stated  that  the  transactions  were 
reviewed  and  the  command’s  comments  were  forwarded  to  the  DoD  OIC  by 
April  8,  2015.  The  Deputy  Assistant  Secretary  also  stated  that  the  Army  will 
continue  to  respond  to  requests  for  clarification  of  the  command  comments.  The 
Army  Component  Program  Manager  provided  the  results  of  the  casino  transaction 
review  in  a  spreadsheet  and  command’s  comments  for  some  Army  organizations. 
Due  to  the  size  and  amount  of  data  in  the  spreadsheets,  we  did  not  include  them  in 
the  report. 

Our  Response 

Comments  from  the  Deputy  Assistant  Secretary  partially  addressed  the 
recommendation.  The  Army  Component  Program  Manager  provided  results  in  a 
spreadsheet  that  did  not  include  all  of  the  Army  organizations,  and  some  results 
had  blank  responses.  In  addition,  we  determined  the  Army  Component  Program 
Manager  did  not  perform  sufficient  reviews  of  all  transactions.  For  example, 
he  reported  instances  of  quasi-cash^^  transactions  as  appropriate  use  with  no 
explanation.  We  believe  quasi-cash  transactions  at  casinos  are  strong  indicators  of 


Transactions  at  a  casino  cage  for  noncash  items  such  as  gambiing  chips. 
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personal  use  and  lead  us  to  question  the  sufficiency  of  the  review.  Therefore,  we 
returned  the  results  to  the  Army  Component  Program  Manager  and  request  that  he 
provide  complete,  sufficient  results  of  the  review  to  us  no  later  than  June  30,  2015. 

Recommendation  3 

We  recommended  that  Navy  Component  Program  Manager  complete  a  review 
of  the  casino  transactions  and  provide  the  results  of  the  review  to  us  no  later 
than  April  8,  2015. 

Management  Comments  Required 

The  Navy  Component  Program  Manager  provided  the  results  of  the  casino 
transaction  review  in  a  spreadsheet  on  April  9,  2015.  Due  to  the  size  and 
amount  of  data  in  the  spreadsheets,  we  did  not  include  them  in  the  report. 

Our  Response 

The  Navy  Component  Program  Manager  provided  results  in  a  spreadsheet, 
and  some  results  had  blank  responses.  In  addition,  we  determined  the  Navy 
Component  Program  Manager  did  not  perform  sufficient  reviews  of  all  transactions. 
For  example,  she  presented  that  a  cardholder  with  three  ATM  transactions  on  the 
same  day  totaling  over  $420  at  Riverwind  Casino,  Norman,  Oklahoma  were  not 
for  personal  use.  The  cardholder  was  authorized  M&IE  of  only  $177.50  for  the 
three  day  trip.  The  cardholder  made  the  three  withdraws  on  the  first  day.  The 
casino  was  located  in  route  to  the  TDY  locations.  We  believe  these  excessive  ATM 
withdrawals  were  a  strong  indicator  of  personal  use  and  led  us  to  question  the 
sufficiency  of  the  review.  We  returned  the  results  to  the  Navy  Component  Program 
Manager  for  further  review  and  request  that  she  provide  complete,  sufficient 
results  of  the  review  to  us  no  later  than  June  30,  2015. 

Recommendation  4 

We  recommended  that  Air  Force  Component  Program  Manager  complete  a 
review  of  the  casino  transactions  and  provide  the  results  of  the  review  to  us 
no  later  than  April  8,  2015. 

Management  Comments  Required 

The  Air  Force  Component  Program  Manager  provided  the  results  of  the  casino 
transaction  review  in  a  spreadsheet  on  April  8,  2015.  Due  to  the  size  and  amount 
of  data  in  the  spreadsheets,  we  did  not  include  them  in  the  report. 
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Our  Response 

The  Air  Force  Component  Program  Manager  provided  results  in  a  spreadsheet, 
and  some  results  had  blank  responses.  In  addition,  we  determined  the  Air  Force 
Component  Program  Manager  did  not  perform  sufficient  reviews  of  all  transactions. 
For  example,  he  presented  that  a  cardholder  with  two  ATM  transactions  on  the 
same  day  totaling  $500  at  Cache  Creek  Casino  in  Brooks,  California  were  not 
personal  use.  The  cardholder  was  authorized  M&IE  of  only  $123.75  for  the  two-day 
trip.  The  cardholder  had  an  additional  ATM  withdrawal  of  $40  at  the  casino  in  the 
same  day,  bringing  the  one  day  total  to  $540  from  a  casino  for  a  2  day  trip.  The 
cardholder  was  reimbursed  $11  for  the  ATM  fees  charged  on  his  excessive  cash 
withdrawals  at  the  casino.  In  addition,  the  cardholder  had  ATM  withdraws  at 
another  casino  about  2  weeks  later  for  over  $300.  We  believe  these  excessive  ATM 
withdrawals  and  repeated  use  at  casinos  were  strong  indicators  of  personal  use 
and  led  us  to  question  the  sufficiency  of  the  review.  We  returned  the  results  to 
the  Air  Force  Component  Program  Manager  for  further  review  and  request  that  he 
provide  complete,  sufficient  results  of  the  review  to  us  no  later  than  June  30,  2015. 

Recommendation  5 

We  recommended  that  U.S.  Marine  Corps  Component  Program  Manager 
complete  a  review  of  the  casino  transactions  and  provide  the  results  of  the 
review  to  us  no  later  than  April  8,  2015. 

Management  Comments  Required 

The  U.S.  Marine  Corps  Head  of  Audit  Coordination,  responding  for  the  U.S.  Marine 
Corps  Component  Program  Manager,  provided  the  results  of  the  casino  transaction 
review  in  a  spreadsheet  on  April  13,  2015.  Due  to  the  size  and  amount  of  data  in 
the  spreadsheets,  we  did  not  include  them  in  the  report. 

Our  Response 

The  U.S.  Marine  Corps  Component  Program  Manager  provided  results  in  a 
spreadsheet,  and  some  results  had  blank  responses.  In  addition,  we  determined  the 
U.S.  Marine  Corps  Component  Program  Manager  did  not  perform  sufficient  reviews 
of  all  transactions.  For  example,  he  presented  that  four  ATM  transactions  totaling 
over  $580  at  Ultron  Processing,  in  Kansas  City,  Missouri  by  three  cardholders  on 
the  same  night  were  not  personal  use.  The  cardholders  had  a  combined  M&IE  of 
$274.50.  We  believe  these  excessive  ATM  withdrawals  were  a  strong  indicator  of 
personal  use  and  led  us  to  question  the  sufficiency  of  the  review.  We  returned  the 
results  to  the  U.S.  Marine  Corps  Component  Program  Manager  for  further  review 
and  request  that  he  provide  complete,  sufficient  results  of  the  review  to  us  no  later 
than  June  30,  2015. 
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Scope  and  Methodology 

We  conducted  this  performance  audit  from  August  2014  through  February  2015 
in  accordance  with  generally  accepted  government  auditing  standards.  Those 
standards  require  that  we  plan  and  perform  the  audit  to  obtain  sufficient, 
appropriate  evidence  to  provide  a  reasonable  basis  for  our  findings  and  conclusions 
based  on  our  audit  objectives.  We  believe  that  the  evidence  obtained  provides  a 
reasonable  basis  for  our  findings  and  conclusions  based  on  our  audit  objectives. 

From  July  1,  2013,  through  June  30,  2014,  DoD  cardholders  used  their  cards  to 
make  approximately  20  million  transactions  totaling  $3.4  billion.  Although  we 
identified  other  questionable  merchant  categories,  we  focused  the  audit  on  casinos 
and  adult  entertainment  establishments  because  we  believed  there  was  a  higher 
risk  for  personal  use  due  to  the  nature  of  the  businesses.  We  used  Internet  sources 
to  obtain  listings  and  directories  of  known  casinos  and  adult  entertainment 
establishments.  We  used  the  merchant  names  on  those  listings  to  identify 
DoD  GTCC  transactional  data  that  occurred  at  casinos  and  adult  entertainment 
establishments.  Specifically,  we  used  separate  queries  in  the  Visa  IntelliLink 
Compliance  Management  system  and  identified: 

•  a  universe  of  24,119  GTCC  transactions  by  13,575  cardholders  at 
U.S.  casinos  with  a  total  value  of  $3,261,727;  and 

•  900  GTCC  transactions  by  646  cardholders  at  adult  entertainment 
establishments  with  a  total-dollar  value  of  $96,576. 

For  transactions  at  casinos,  we  developed  a  detailed  methodology  and  applied 
filters  and  tests  to  the  universe  to  eliminate  transactions  that  were  not  an  indicator 
of  misuse  (such  as  for  a  hotel  stay  or  meal  at  a  casino  restaurant  while  on  official 
travel].  Specifically  we  eliminated  transactions  under  $100  and  then  tested  for  the 
following  indicators  of  potential  personal  use: 

•  employee  not  on  DTS  orders  at  the  time  of  the  transaction; 

•  ATM  withdrawals  greater  than  total-trip  per  diem; 

•  multiple  ATMs  or  purchases  over  $100  in  the  same  day; 

•  quasi-cash  transactions; 

•  transactions  in  a  state  other  than  the  cardholders  home  state  or 
the  TDY  state; 

•  more  than  four  transactions  over  $100  in  a  week;  or 

•  more  than  three  ATM  transactions  in  a  week. 


28  I  DODIG-2015-125 


Appendix 


Also  indicators  of  potential  personal  use,  the  following  required  at  least  one  other 
indicator  to  be  considered  as  potential  personal  use: 

•  ATM  withdrawals  over  $300; 

•  ATMs  in  the  same  state  as  cardholder  residence; 

•  transactions  on  a  holiday;  or 

•  transactions  greater  than  two  times  the  total  lodging  amount  for  the  trip. 

As  a  result  of  the  11  tests  and  filters  above,  we  determined  that  4,437  transactions 
by  2,636  cardholders  totaling  $952,258,  at  casinos  were  high  risk  and  likely  for 
personal  use. 

We  nonstatistically  selected  seven  cardholders  for  further  analysis.  These 
cardholders  were  selected  for  different  reasons,  including:  the  number  of 
transactions,  location  of  the  transactions,  multiple  adult  entertainment 
establishments  or  the  use  of  casino  processing  companies.  We  also  covered  all 
Military  Services  and  one  Defense  Agency.  For  these  cardholders,  we  reviewed 
additional  transactions  beyond  the  July  1,  2013,  through  June  30,  2014,  scope 
to  determine  whether  there  was  prior  or  subsequent  abuse.  We  also  provided 
a  complete  listing  of  the  transactions  that  appeared  to  indicate  personal  use 
of  the  GTCC  to  the  CPMs  at  each  Military  Service  for  their  review  and  action 
as  appropriate. 

In  addition  to  the  individually  billed  travel  cards,  the  DoD  Travel  Card 
Program  has  centrally  billed  accounts  (CBAs).  From  July  1,  2013,  through 
June  30,  2014,  DoD  used  CBAs  to  make  roughly  2.5  million  transactions  totaling 
approximately  $899  million.  We  reviewed  DoD  CBA  transactions  to  identify 
any  personal  use  of  the  CBA.  We  performed  a  query  of  all  CBA  transactions  and 
identified  78  transactions  at  U.S.  casinos  totaling  $517,111  but  did  not  identify 
any  CBA  transactions  at  adult  entertainment  establishments.  We  reviewed 
five  CBA  accounts  with  42  transactions  at  casinos  totaling  $489,203  and  found  that 
the  transactions  were  proper  and  were  not  for  personal  use  at  a  casino. 

We  interviewed: 

•  DTMO  personnel; 

•  CPMs  and  APCs  at  each  Military  Service;  and 

•  Citibank  information  technology  staff  managing  the  DoD  travel 
card  program. 

We  reviewed  public  law,  the  DoD  FMR,  and  DTMO  and  Component-level 
guidance  related  to  cardholder  use  and  management  oversight  of  Government 
travel  charge  cards. 
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Use  of  Computer-Processed  Data 

We  used  computer-processed  data  from  Visa  IntelliLink  Compliance  Management, 
Citi  Electronic  Access  Systems,  and  DTS.  The  data  we  obtained  were  sufficiently 
reliable  for  the  purposes  of  our  audit,  and  we  established  data  reliability  based  on 
the  following  information. 

We  used  Visa’s  IntelliLink  Compliance  Management  system  to  access  Visa 
transactional  data.  Visa  has  extensive  security  standards  that  require 
merchants  and  issuers  (banks)  to  comply  with  an  industry  standard  known  as 
the  Payment  Card  Industry  (PCI)  Data  Security  Standard  (DSS).  According  to 
Visa,  all  entities  that  store,  process,  or  transmit  Visa  cardholder  data — including 
financial  institutions,  merchants  and  service  providers — must  comply  with  PCI  DSS. 
The  PCI  Security  Standards  Council  oversees  the  security  standards  that  include  a 
compliance  program  for: 

•  assessing  controls; 

•  reporting  or  validating  controls,  or  both,  are  in  place;  and 

•  monitoring  or  alerting,  or  both,  of  existing  controls. 

The  PCI  DSS  certification  for  Visa  IntelliLink  Compliance  Management  was  valid 
through  December  31,  2014. 

An  independent  service  auditor  reviewed  Citi’s  technology  infrastructure  in 
a  2013  Service  Organization  Control  (1)  Report.  The  auditor  determined  the 
controls  were  suitably  designed  to  operate  effectively  and  provided  reasonable 
assurance  that  the  control  objectives  were  achieved  and  operated  effectively. 
Calendar  year  2013  includes  the  first  6  months  of  our  audit  scope  (July  2013 
through  June  2014).  To  establish  further  assurance,  we  reviewed  additional  data 
queried  from  a  broader  time  period  from  January  2011  through  September  2014. 

We  compared  cardholder  transactional  information  obtained  from  Citi  and  Visa 
that  did  not  find  any  reliability  issues. 

In  2013,  DLA  completed  a  readiness  review  of  DTS  system  controls  and 
subsequently  asserted  on  December  11,  2013,  that  the  DTS  information  technology 
system  control  activities  were  ready  for  audit.  Because  the  audit  of  DTS  had  not 
yet  been  conducted  (scheduled  for  FY  2015),  we  verified  DTS  information  we 
obtained  (travel-order  dates  and  voucher  expenses)  to  other  sources  as  appropriate 
to  establish  its  reliability. 


30  I  DODIG-2015-125 


Appendix 


Use  of  Technical  Assistance 

The  team  met  with  the  Quantitative  Methods  Division  and  discussed  their  approach 
during  the  planning  phase  of  the  audit. 

Prior  Coverage 

During  the  last  5  years,  we  did  not  identify  any  audits  related  to  DoD  travel  card 
personal  use  at  casinos  or  adult  entertainment  establishments. 
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Management  Comments 

Director,  Defense  Travel  Management  Office 


OFFICE  OF  THE  UNDER  SECRETARY  OF  DEFENSE 
4&00  DEFENSE  PENTAGON 
WASHINGTON,  D.C. 


APR  2  0  2015 

PERSONNEL  AMD 
READINESS 
OTMO 

Progiam  Director 

Contract  Management  and  Payments 
Office  of  the  Inspector  General 
Depiirtment  of  Defense 
4800  Mark  Center  Drive 
Alexandria,  Virginia  22350 

Dear 

This  letter  is  the  Department  of  Defense  response  to  your  request  for  comments  on  Office  of 
the  InspectoT  General  draft  report,  “DoD  Cardholders  Used  Their  Govemment  Travel  Cards  for 
Personal  Use  at  Casinos  and  Adult  lintertainment  Establishments,”  dated  Muich  23,  2015,  (Project 
No,  D20!  4-000001.-0201 .000).  Comments  on  the  report  recommendalions  are  enclosed. 

Although  the  report  does  not  call  attention  to  the  fact,  the  Department  of  Defense 
Government  Travel  Charge  Card  program  and  related  compliance  is  very  strong.  The  report 
language  applies  a  very  broad  stroke  against  all  cardholders  when,  in  reality,  personal  use  of  the 
Government  I  ravel  Charge  Card  is  negligible  when  compared  to  the  size  and  scope  of  the  pi-ogram. 
Accordingly,  in  addition  to  the  enclosed  eommenls,  I  offer  the  following: 

*  The  personal  use  identified  in  the  report  amounts  to  0.0307%  oflhc  total  card  spend  of 
$3,417  billion  dollars  on  individually  billed  accounts  during  the  period  of  the  audil,  a  very 
strong  indicator  of  program  compliance  and  overall  good  health  of  the  program. 

*  The  personal  use  identified  in  the  report  amounts  to  0,0275%  of 220,1 18  million  total 
transactions  on  individually  billed  accounts  during  the  period  of  the  audit. 

*  Personal  use  of  the  individually  billed  card,  while  considered  misuse,  docs  not  result  in  the 
payment  or  loss  of  U.S.  taxpayer  dollars  given  that  charges  inciurcd  for  personal  use  are  not 
reimbursed  to  the  cardholder;  the  card  heldet  must  pay  the  cost  of  unauthorized  or  personal 
use  transactions  ‘'out  of  pocket.” 

*  Department  of  Defense  delinquency  rates  for  individually  billed  accounts  averaged  just  over 
1%  for  fiscai  year  2015,  second  quarter.  This  compares  to  an  industry  average  (per 
discussions  with  Visa  and  Citibank)  of  more  than  4%.  This  is  another  strong  indicator  of  the 
overall  success  of  the  program  and  is  all  the  more  impressive  considering  the  Department's 
program  is  the  lai'gcst  travel  caixl  program  in  the  United  Slates, 
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Dcpurtmeiii  of  Dcfciisf:  Comments  on  OIG  Draft  Report 
*‘DoD  Cardholders  Used  Their  Government  Travel  Cards  for  Personal  Use  at 
Casinos  and  Adult  Entcrtainnient  Establish meiitsj’*  dated  March  23^  2015, 
(Project  No,  D2O14^D0OOCL-02OLOOO) 

RccommeiidatioTi  hi:  “Establish  a  working  group  with  the  Mililary  Services,  Defense 
agencies,  and  bank  representatives  to  determine  what  tools,  techniques,  or  technologies 
arc  most  appropriate  to  prevent  or  identify  personal  use  of  the  Governmenl  travel  charge 
card  at  casinos  and  adult  entertainment  establishments.  Specifically  the  tools,  techniques 
or  technologies  should  enable  Agency  Program  Coordinators  to  identify: 

L  '[’Tavcl  card  transactions  that  do  not  have  associated  travel  status  in  Defense  Travel 
System  or  other  DoD  travel  systems; 

2.  Automated  teller  machine  withdrawals  that  exceed  the  overall  meal  and  incidental 
expense  amounts  while  in  a  travel  status; 

3.  Travel  card  transactions  that  occur  at  specific  known  casinos,  casino-pTocessing 
centers,  and  adult  entertaimneiit  establisliments; 

4.  Travel  card  declined  authorization  activity  that  could  indicate  personal  use; 

5.  Travel  card  activity  outside  the  official  Government  travel  location.” 

Response:  Agree  in  Part  While  we  agree  with  the  need  to  work  closely  with  the 
Military  Services,  Defense  Agencies,  and  bank  representatives  to  determine  what  tools, 
techniques,  or  technologies  m-e  most  appropriate  to  prevent  or  identify  personal  use  of  the 
Government  Travel  Charge  Card  (GTCC),  we  do  not  agree  that  a  specific  working  group 
needs  to  be  established  to  do  so,  The  Defense  Travel  Management  Olficc  (D'fMO)  is, 
and  has  always  been,  thoroughly  engaged  with  the  Component  Program  Managers 
(CPMs)  and  Citibank  on  a  daily  basis,  as  well  as  through  regularly  recurring  quarterly 
meetings  and  pKJgrain  reviews.  We  will  continue  to  engage  through  the  aforementioned 
forums  to  ensure  ihe  continued  successful  management  of  the  program. 

Our  efforts  will  eonlinuc  to  focus  on  improved  and  more  prevalent  usage  of  the  existing 
reporting  and  data  mining  tools  made  available  by  Citibank  (the  Citibank  Customer 
Reporting  System)  and  Visa  (IntelliLink©)  to  ideniily  potential  personal  use  of  the  card. 
Pursuant  to  the  research  and  audit  phase  of  this  project,  we  conducted  refresher  training 
on  these  tools  and  will  also  include  training  courses  for  our  AFCs  on  the  use  of  these 
tools  at  the  GSA  SmartPay  Forum  currently  being  scheduled  tor  later  this  year.  We  have 
already  created  new  reports  in  the  Visa  IntellilJnkO  tool  to  identify  use  at  casinos  and 
adult  entertainment  establishments,  and  continue  to  txmduct  visioning  sessions  focused 
on  reporting  with  Citibank  and  Visa. 

While  the  report  identified  the  expansion  of  the  DTiVlO  Compliance  Tool  as  a  potential 
means  to  identify  personal  use,  the  Compliance  Tool  was  specifically  developed  to 
identify  and  assist  with  the  recovery  of  improper  and/or  overpaid  travel  reimbursements 
in  accordance  with  the  requirements  of  the  Improper  Payments  Elimination  and  Recovery 
Act  (iPERA)  of  2010.  As  such,  it  will  provide  the  Department  with  an  estimated  S20 
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million  annual  return  on  investment  when  fully  developed  to  mclude  all  planned  queries. 
There  would  be  no  similar  return  on  investment  to  enhance  tlie  tool  to  identify  potential 
personal  use  of  the  travel  card,  since  such  use  does  not  result  in  an  improper  payment  or 
reimbursement  Ici  the  traveler.  As  noted  above,  we  will  use  other  methods  to  identify 
improper  personal  use  of  the  GTCC. 

Rccummendation  lb:  “Determine  the  feasibility  of  deactivating  travel  cards  and 
reducing  caid  limits  for  cardholders  while  not  on  official  travel.” 

Response:  Agree.  It  is  current  DoD  policy ^  and  0MB  guidance,  to  deactivate  restricted 
accounts  for  cardholders  not  in  a  travel  status.  We  arc  currently  working  with  Citibank 
and  our  CPMs  to  improve  enforcement  of  this  policy. 

Recommendation  Ic:  '"Revise  the  DoD  Financial  Management  Regulation^  volume  9, 
chapter  3,  to  include  examples  of  merchant  categories  that  arc  considered  high  risk  for 
personal  use,  such  as  casinos  and  adult  entertainment  establishments.” 

Rcsnotise:  Disagree.  DoD  policy  contained  in  DoDFMR,  Volume  9,  Chapter  3, 
Paragraph  030301  and  030103  clearly  prchibits  card  use  for  other  than  official  authorized 
expenses  in  support  of  official  traveL  To  help  clarify  what  typ&s  of  expenses  are 
aulhorived,  our  current  drall  update  includes  a  reference  to  tJie  Joint  Travel  Regulations. 
Additionally,  baseii  on  the  extremely  low  percentage  of  transactions  and  related  spend 
identified  in  the  report,  personal  use  at  casinos  and/or  adult  entertainment  establishments, 
while  high  risk  in  nature,  does  not  appear  to  be  a  critical  problem  within  the  DoD  travel 
card  program.  I  low  ever,  we  do  take  the  issue  of  personal  use  seriously  and  our  training 
material  includes  this  topic. 

Recommendiition  Idl:  “Require  APCs  to  rcvicw  the  declined  authori/ation  report  at 
least  monthly.” 

Response:  Disagree.  The  Declined  Authorization  Report  is  not  a  viable  tool  to  identify 
personal  use  transactions  because  there  are  many  different  masons  that  a  transaction  may 
be  declined  that  have  no  relationship  to  improper  perstmal  use.  For  example,  a 
transaction  could  be  declined  due  to  an  incorrect  travel  card  profile  in  DTS,  the  card  not 
being  activated  in  support  of  official/authorizcd  travel,  or  an  insufficient  available  credit 
limit  in  support  of  official/authorizcd  travel.  It  would  be  very  dillftcult  and  time 
consuming  for  an  APC  to  review  this  report  and  distill  from  it  the  information  that  would 
indicate  improper  personal  use. 

Recommend adon  ld2:  '"Require  APCs  to  use  the  Visa  Intel HLink©  tool  to  assist  in  the 
reviews  of  monthly  GTCC  activity  for  personal  use  or  other  misuse.” 

Response:  Agree  in  Part.  We  agree  that  the  reports  Iroin  Visa  Intellifank©  provide 
information  regarding  potential  personal  use  or  other  misuse  and  are  a  valuable  tool,  7'hc 
Citibank  Custom  Reporting  System  is  another  valuable  tool  that  also  provides  this 
informatton.  Rather  than  limiting  our  APC  with  a  requirement  to  use  one  tool  over  tlic 
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other,  the  draft  update  to  our  cunotit  pjrogiam  regulations  gives  our  APCs  the  flexibility 
to  use  whichever  reporting  Itiol  they  are  most  eomforlable  and  familiar  with. 

Reeoinmcii<latioii  1  et :  “Coordinate  with  the  General  Services  Administration  to 
determine  whether  the  Citibank  contract  should  be  modified  to  lequirc  Citibank  to  block 
usage  of  the  GTCC  at  specifle  casino  locations  or  adult  entertainment  establishments.” 

Response:  Agree.  We  will  coordinate  with  the  General  Services  Administration  (GSA) 
on  this  issue. 

Recommendation  ie2:  “Coordinate  with  the  General  Services  AdminisU-ation  to 
delermiue  whether  the  Citibank  contract  should  be  modified  to  i^equire  Citibank  to  notify 
CPMs  or  APCs  of  potential  fraudulent  activity  or  suspension  of  travel  cards,” 

Response:  Agree.  We  will  coordinate  witli  GSA  on  this  issue  and  enter  into  discussions 
with  Citibank  regarding  possibility  and  feasibility. 
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MEMORANDUM  FOR  U.S.  Army  Audit  Agency,  6000  6th  Street,  Building  1464,  Fort 
Belveir,  VA  22060-5609  I 

SUBJECT ;  Department  Of  Defense  Inspector  General  braft  Report,  23  March  201 5: 
Department  of  Defense  Cardholders  Used  Their  Govenj men!  Travel  Cards  for  Personal 
Use  at  Casinos  and  Adult  Entertainment  Eslahlishnnents  (D2014CL-0201 ) 

1 ,  Below  is  the  reply  to  the  draft  recommendations  froni  the  subject  report  from  the 
Deputy  Assistant  Secretary  of  the  Army  (Financial  Operations): 

a.  Recommendation  1 :  We  recommend  the  Army  Cjornponent  Program  Manager 
complete  a  review  of  the  casino  transactions  and  provide  the  resuits  of  the  review  to  us 
no  later  than  April  8,  2015. 

b.  Action  Taken:  Transactions  were  reviewed  and  origtnai  spreadsheets  containing 
command  comments  and  action  taken  were  forwarded  ip  the  Department  Of  Defense 
Inspector  General  (DoDIG)  by  April  6,  2015.  We  will  continue  to  respond  to  DoDIG 
requests  for  clarification  of  command  comments  as  reqtjiired. 

3.  The  point  of  contact  is  Ihe  Army  DejFense  Travel  System  Program 

Manager.  He  can  be  reached  by  at  |;^y  e-nnail  at 


De,  ^  ^  ^  the  Army 

(Financial  CjJperations) 
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APC 

Agency  Program  Coordinator 

ATM 

Automated  Teller  Machine 

CBA 

Centrally  Billed  Account 

CPM 

Component  Program  Manager 

DLA 

Defense  Logistics  Agency 

DTMO 

Defense  Travel  Management  Office 

DTS 

Defense  Travel  System 

FMR 

Financial  Management  Regulation 

GSA 

General  Services  Administration 

GTCC 

Government  Travel  Charge  Card 

M&IE 

Meals  and  Incidental  Expenses 

MCC 

Merchant  Category  Code 

TDY 

Temporary  Duty 
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The  Whistleblower  Protection  Enhancement  Act  of  2012  requires 
the  Inspector  General  to  designate  a  Whistleblower  Protection 
Ombudsman  to  educate  agency  employees  about  prohibitions 
on  retaliation,  and  rights  and  remedies  against  retaliation  for 
protected  disclosures.  The  designated  ombudsman  is  the  DoD  Hotline 
Director.  For  more  information  on  your  rights  and  remedies  against 
retaliation,  visit  www.dodig.mil/programs/whistleblower. 


For  more  information  about  DoD  IG 
reports  or  activities,  please  contact  us: 

Congressional  Liaison 

congressional@dodig.mil;  703.604.8324 

Media  Contact 

public.affairs@dodig.mil;  703.604.8324 

Monthly  Update 

dodigconnect-request@listserve.com 

Reports  Mailing  List 

dodig_report@listserve.com 

Twitter 

twitter.com/DoD_IG 

DoD  Hotline 

dodig.mil/hotline 
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